Examkin

Question

Difficulty: HardApplication Authentication and Authorization with Amazon Cognito

A developer is building a serverless web application that allows authenticated users to read and write items in a shared Amazon DynamoDB table. The application needs to support self-service user registration and login, as well as authenticate users via a secure directory. The client application runs in the browser and must interact directly with the DynamoDB table using temporary AWS credentials, ensuring that each user can only access items where the partition key matches their unique user identifier. Which combination of steps should the developer perform to configure the authentication and authorization mechanism? (Select TWO.)

  1. Create an Amazon Cognito User Pool to serve as the user directory and handle user registration, authentication, and token generation.Answer
  2. B
    Create an Amazon Cognito Identity Pool to manage the user directory and handle user registration, and use a custom API Gateway Lambda authorizer to validate users.
  3. Create an Amazon Cognito Identity Pool, configure the User Pool as an identity provider, and associate the authenticated IAM role with a policy that restricts DynamoDB access using the `${cognito-identity.amazonaws.com:sub}` policy variable.Answer
  4. D
    Configure an API Gateway Cognito authorizer that validates the user's ID token and directly modifies the trust policy of the DynamoDB table's IAM role to allow direct client access.
  5. E
    Create an Amazon Cognito User Pool and modify the associated IAM trust policy to allow the User Pool to directly execute the `sts:AssumeRole` API call to retrieve credentials for the client application.

Answer

Create an Amazon Cognito User Pool to serve as the user directory and handle user registration, authentication, and token generation; and create an Amazon Cognito Identity Pool, configure the User Pool as an identity provider, and associate the authenticated IAM role with a policy that restricts DynamoDB access using the `${cognito-identity.amazonaws.com:sub}` policy variable.
The correct architecture requires Cognito User Pools to manage the user identity directory and authentication. It then requires Cognito Identity Pools to authenticate those users against AWS services by exchanging user pool tokens for temporary AWS credentials. Fine-grained access control in DynamoDB is enforced by applying an IAM policy to the authenticated role using the `${cognito-identity.amazonaws.com:sub}` policy variable as a condition matching the partition key.

Step-by-Step Solution

1
Configure a Cognito User Pool to act as the identity provider.
Users can sign up, log in, and retrieve JSON Web Tokens (JWT) containing their identity information.
User Pools are used to manage authentication and user directories.
2
Configure a Cognito Identity Pool and link it to the User Pool.
The identity pool receives the JWT from the user pool and exchanges it for temporary AWS credentials.
Identity Pools are designed for authorization, exchanging third-party or user pool tokens for temporary AWS credentials.
3
Attach a fine-grained access control policy to the IAM role assumed by authenticated users.
The user is allowed to read and write only their own items in the DynamoDB table, restricted by the user's Cognito identity ID.
Using the `${cognito-identity.amazonaws.com:sub}` variable in the IAM policy condition limits DynamoDB table actions (like PutItem, GetItem) to items where the partition key matches the user's specific identity ID.

Key Concept

The separation of concerns between Amazon Cognito User Pools (authentication/directory) and Identity Pools (authorization/temporary credentials), and using fine-grained access control policies.
Rate this question

Topics

Application Authentication and Authorization with Amazon Cognito

More questions from this topic